If the UTM server is not reachable as shown below, the HTTP connection may be delayed and result in slow HTTP traffic.

root@SRX-240-3# run show security utm web-filtering status
UTM web-filtering status:
    Server status: Juniper Enhanced using Websense server DOWN

In the following traffic log, the traffic is finally permitted due to ' BY_FALLBACK_TIMEOUT ':

Jul  3 07:03:38  SRX-240-3 RT_UTM: WEBFILTER_URL_PERMITTED: WebFilter: ACTION="URL Permitted" 1.1.1.2(38099)->151.101.72.222(443) CATEGORY="Enhanced_Web_Analytics" REASON=""BY_FALLBACK_TIMEOUT" PROFILE="ewf-http" URL=xxx.xxxx.xxx.com OBJ=/ username N/A roles N/A

If the TSC does not respond in time to the categorization request from the device, the original client request is blocked or permitted according to the timeout fallback setting (default action is log and permit).  If the traffic is permitted due to 'FALLBACK_TIMEOUT' , the traffic will not be passed until the timeout is reached, which will be slow.

Workaround:

1. Disable EWF
   Deactivate security utmfeature-profile web-filtering type

2. Decrease EWF Timeout value
   set security utm feature-profile web-filtering juniper-enhanced profile ewf-http timeout 1

Solution:

Traceoption:

• traceoptions (Security Web Filtering)  
• traceoptions (Security UTM)

Pakect capture:

• KB11709 - How to create a PCAP packet capture on a J-Series or SRX branch device [juniper.net]
• KB16233 - How to use 'flow traceoptions' and the 'security datapath-debug' [juniper.net]

Useful commands:

• Show host rp.cloud.threatseeker.com
• Traceroute rp.cloud.threatseeker.com
• Show security flow session destination-prefix <TSC-IP-address>
• Configflow traceoptionwith both IP address as filters
• PCAP packet destined to rp.cloud.threatseeker.com

Please contact JTAC for further troubleshooting.